CVE-2025-55659
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk27th percentile - higher than 27% of all known CVEs
Summary
GPAC MP4Box v2.4 has a NULL pointer dereference in the ctts_box_write function (isomedia/box_code_base.c). Attackers can cause a Denial of Service (DoS) by supplying a crafted MP4 file.
Risk Assessment
The organization is at risk of application crash when processing malicious MP4 files, potentially disrupting services relying on this tool.
Recommendation
Update GPAC MP4Box to a version newer than 2.4 where this vulnerability is fixed.
Other vulnerabilities in GPAC MP4Box
See all- CVE-2025-60465Medium
A use-after-free vulnerability was found in the gf_filter_pid_inst_swap function of GPAC/MP4Box before version 26.02.0. An attacker can supply a crafted media file to cause a Denial of Service (DoS).
- CVE-2025-60464High
A use-after-free vulnerability was found in the gf_sei_load_from_state_internal function (/filters/sei_load.c) of GPAC/MP4Box before version 26.02.0. Attackers can cause a Denial of Service (DoS) by supplying a crafted MPEG-2 TS file.
- CVE-2025-60473Medium
A NULL pointer dereference vulnerability was found in the gf_filter_in_parent_chain function of GPAC/MP4Box before version 26.02.0. Attackers can cause a Denial of Service (DoS) by supplying a crafted file.
- CVE-2025-60466Medium
A use-after-free vulnerability was found in the gf_filter_pid_get_packet function (/filter_core/filter_pid.c) of GPAC/MP4Box before version 26.02.0. Attackers can cause a Denial of Service (DoS) by supplying a crafted media file.
- CVE-2025-60474High
A buffer overflow vulnerability in the gf_media_import function of GPAC/MP4Box before version 26.02.0 allows an attacker to cause a Denial of Service (DoS) by supplying a crafted input file.
- CVE-2025-55639Medium
A NULL pointer dereference vulnerability was discovered in GPAC MP4Box v2.4 in the gf_isom_add_track_kind() function at isomedia/isom_write.c. Attackers can exploit this by crafting a malicious MP4 file to cause a Denial of Service (DoS).
- CVE-2025-55663Medium
A segmentation violation in the Track_SetStreamDescriptor function in GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) by supplying a crafted MP4 file.
- CVE-2025-55661Medium
A heap buffer overflow in the Opus audio stream parser component of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file.
- CVE-2025-55660Medium
A stack overflow in the gf_opus_read_length function in GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) by supplying a crafted MP4 file.
- CVE-2025-55652Medium
A heap buffer overflow in the gf_isom_vp_config_new function in GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) by supplying a crafted MP4 file.
Original NVD description (English source)
A NULL pointer dereference in the ctts_box_write function (isomedia/box_code_base.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file.